Windows DHCP Client CVE-2026-49181

Exploitation requires the target to be running and actively using the Windows DHCP Client service (default on for DHCP-configured hosts) and requires the attacker to be able to deliver crafted DHCP response traffic that the client will parse - practically meaning attacker presence on the same broadcast/L2 segment or a position to answer DHCP (rogue DHCP server or DHCP spoofing), because DHCP is a link-local protocol. Per CVSS the attack needs no authentication (PR:N) and no user interaction (UI:N) against default configurations. Limiting factors: hosts configured with static IP addressing and the DHCP Client service disabled are not exposed; the practical requirement to be on the same network segment constrains this from being a fully internet-routable attack despite the AV:N rating; and only the listed unpatched Windows/Windows Server builds are affected.

The signals are mixed and worth reconciling. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes an easy, unauthenticated, network-reachable, full-impact bug - a maximum-severity profile. However, the exploitation-status signals temper this: EPSS is only 0.76% (51st percentile), CISA SSVC lists Exploitation as 'none' and Technical Impact as only 'partial' (not 'total'), and there is no KEV listing and no public POC. SSVC does mark it 'Automatable: yes', consistent with a network service that processes unsolicited traffic. A notable tension: the description frames this as 'elevate privileges over a network,' yet DHCP is inherently a link-local/broadcast protocol, so realistic exploitation likely requires the attacker to be on the same L2 segment (adjacent) rather than truly routable-Internet 'network' reach - the AV:N rating may overstate remote reachability. Net assessment: a genuinely serious client-side memory-safety bug that should be patched promptly, but the low EPSS, 'none' exploitation status, and 'partial' technical impact suggest it is not yet a mass-exploited emergency - treat as high-priority patch, not active-incident.

An attacker who can place traffic on the victim's local network segment (for example a rogue or compromised device on the same LAN/Wi-Fi, or a spoofed DHCP responder) sends a crafted DHCP OFFER/ACK containing malformed option length fields that trigger the integer underflow in the Windows DHCP Client, corrupting memory and escalating to elevated code execution on the target. Because CVSS rates complexity low (AC:L) with no privileges or user interaction required and SSVC marks it Automatable, the attack could be scripted against many hosts on a segment; however, no public exploit code has been identified at time of analysis.